TwentyOne
First Flight #29
Beginner FriendlyGameFiFoundrySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Lack of equal points scenario (push) in Blackjack in call function

eth0x

Summary

A push occurs when both the player and the dealer end up with the same total points at the end of a round. This can happen with any total, but a common example is when both have 21 points.

Vulnerability Details

  1. I invoke startGamesfunction - as a result I had two cards: [47,46]

  2. After that I put hit - in my hand were [47,46, 6] cards with value 21.

  3. I invoke call and a result was:

"args": {
"0": "Dealer's hand is higher, dealers winning hand: ",
"1": "21",
"message": "Dealer's hand is higher, dealers winning hand: ",
"cardsTotal": "21"
}

If the value of the player's and the dealer's cards are equal, it results in a "push," and the player's funds should be returned.

Impact

An improper implementation of blackjack rules, which lacks the function to withdraw the player's funds after a "push," can result in blocking the player's funds. Due to these incorrect rules, the player does not win, and their funds remain unavailable.

Tools Used

manual review

Recommendations

Please rethink protocol design.

function call() public {
require(
playersDeck[msg.sender].playersCards.length > 0,
"Game not started"
);
uint256 playerHand = playersHand(msg.sender);
​
// Calculate the dealer's threshold for stopping (between 17 and 21)
uint256 standThreshold = (uint256(
keccak256(
abi.encodePacked(block.timestamp, msg.sender, block.prevrandao)
)
) % 5) + 17;
​
//@audit ddos
// Dealer draws cards until their hand reaches or exceeds the threshold
while (dealersHand(msg.sender) < standThreshold) {
uint256 newCard = drawCard(msg.sender);
addCardForDealer(msg.sender, newCard);
}
​
uint256 dealerHand = dealersHand(msg.sender);
​
// Determine the winner
if (dealerHand > 21) {
emit PlayerWonTheGame(
"Dealer went bust, players winning hand: ",
playerHand
);
endGame(msg.sender, true);
//@audit what if player has 23
} else if (playerHand > 21) {
emit PlayerLostTheGame(
"Player went bust, player's losing hand: ",
playerHand
);
endGame(msg.sender, false);
} else if (playerHand > dealerHand) {
emit PlayerWonTheGame(
"Dealer's hand is lower, players winning hand: ",
playerHand
);
endGame(msg.sender, true);
} else if (playerHand < dealerHand) {
emit PlayerLostTheGame(
"Dealer's hand is higher, dealers winning hand: ",
dealerHand
);
endGame(msg.sender, false);
//@audit statement for
} else {
emit GamePush(
"Push: Both player and dealer have the same hand: ",
playerHand
);
endGame(msg.sender, false);
}
}
​
Updates

Lead Judging Commences

inallhonesty Lead Judge 9 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Tie case

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.